Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Using geostats, I want the pie chart for that location to show 10/5/1, instead it shows 1/1/1. Does that make sense?

Everything I want for the stats output is good. Geostats doesn't take into account the count it just takes the row as one event. SO if I have 700k events I end up with 70k events in my piecharts because it is not counting the individual events in bloodType. Don't know if my example helped.

I just want to know if what I am trying to do is even possible. I have tried multiple things just haven't been able to accomplish what I want to achieve. I will expand later... just wanted to get the initial question up. Thanks!

People who like this

1 Answer

The problem is that geostats is getting confused between the count field that came out of the stats command and the count it's generating itself. The latter, being more "local", will supersede and hide the former. So, just try this -

If you are trying to speed the response, make sure that the data to be analyzed has been culled at the earliest point possible -- use table or fields commands to limit the data to only the fields you need -- and do any reformatting at the latest point possible. For instance, pass all the dates as Epoch time and do summary/stats commands in that form, then at the last moment format them for human consumption.

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here. Closing this box indicates that you accept our Cookie Policy.